Changes touching this path

• day 0: loot hosts loot f4c30e75 · dbf3dbe6…
• evidence: crew minted and verified (#86) 1fada823 · dbf3dbe6…diff
• normalize working tree to LF: byte-stable co-located bridge (.gitattributes -text) e58fdda6 · dbf3dbe6…diff
• Workspace accepts its clock; lane flag-gate goes pure so cmd_* tests never touch a real .loot (#322) 20ac82e1 · dbf3dbe6…diff
• Grant expiry: optional expires_at on GrantEntry and tag-3 wire (#20) a01c3d53 · dbf3dbe6…diff
• Correct the Internal-tier and Manifest facts where truth lives (#497, #498) (#505) * Correct two false facts where truth lives: Internal is sealed, the Manifest is local (#497, #498) Both tickets are editorial: prose that was trusted instead of checked against the engine. Every claim below was re-verified against the source. #497 — spec §1 called Internal a "plaintext object, not sealed". False: `loot_codec::sealed::seal` encrypts unconditionally with AES-256-GCM for every visibility; the tier selects only zstd (`compressed = matches!(vis, Visibility::Internal)`). There is no plaintext-object path. What separates the tiers is where the content key travels, so repo membership *is* the Internal boundary — a gate over bytes the server cannot read, not one bolted over plaintext it could. Corrected in the spec tier table (+ a new paragraph), CONTEXT.md's Visibility glossary, and ADR 0041, where the same wording had leaked into the tier list, the Vocabulary rationale, and a rejected alternative. #498 — CONTEXT.md's Manifest entry claimed it "travels in bundles ... so every peer has a complete audit trail". False: `BundleBody` is `{ changes, objs, keys, attestations }`, with no manifest lane; the Manifest is written by `apply_sealed_grant` and persisted by `save_to`, local-only. The trail is per-peer and partial. The error originates in ADR 0008, whose title asserts it and whose last consequence promised a wire section that `git log -G manifest -- bundle_codec.rs` shows was never written. Amended in place rather than rewritten — the decision is history; the amendment records that it was not built, and that this is why the forge's `grant_log` has no wire producer (#484 supplies one). Also fixed the same false claim still live in `manifest.rs`'s own doc comment, and dropped the clause's "escrow entries" half: the plaintext escrow bundle section was deliberately removed in format v5 (ADR 0027) because it shipped plaintext keys. Docs + one doc comment; no behavior change. cargo check --workspace clean; loot-core + loot-codec 357 tests pass. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * Fold in the #494 review findings the ticket widened #497 to cover (#497) Eleven recording-hygiene and accuracy defects a two-axis review of d20d2b2c found in the same three files, folded into this landing per the ticket comments. None change a decision. Hard: 1. ADR 0041 was amended in place with no marker and no #494 citation, so the metadata subsection read as decided at acceptance. Added the repo's established `> **Amended <date> (#nnn):**` form; #494 is now cited in all three files. 2. The ADR had taken on DDL (`repo.metadata_public boolean NOT NULL DEFAULT false`) it explicitly delegates to the spec. It now states the axis; the column and type live only in the spec. 3. `vis_tag` was undefined in-repo and collided with a same-named wasm display helper of a different type. Now "visibility tag" in prose, as the ADR had it. Accuracy: 4. Dropped the ADR 0038 overclaim. That gate fires on a secret-shaped name resolving world-readable by fallthrough, per path, at a signing verb; a derived-metadata leak has neither path nor name shape, so it could never fire. Kept as an analogy of accident *class*, explicitly not of mechanism. 5. The flag is consulted only for anonymous readers (`access_class <> 'anon' OR r.metadata_public`, verified against #483), so it widens access rather than narrowing it. All three files had implied it and the access class were coequal inputs. 6. Recorded the invariant that makes the listTree corollary safe to build from: tree rows store no Restricted id-set, and grant_log is the sole answer to "who". Without it a builder could render the grantee set and leak who has access on a metadata-public repo. 7. Replaced the undefined "barrier-view predicate" ("barrier" already means ADR 0031 operation barriers) with a definition at its one buildable home. Judgement: 8. Thinned the spec to normative statements; the ADR keeps the rationale, so renaming the column at build time is one edit rather than three. 9. Gave the rejected repo-level Public/Private toggle its reciprocal note — Alternatives sections get read standalone. 10. Moved Metadata visibility below Identity in CONTEXT.md, restoring the antecedent its 17-line insertion had severed, and back-linked it from Visibility. Citation now uses the dominant *(decided <date>, …)* form. Also, from #484 via the same ticket: recorded the missing-producer pattern as a standing ADR 0041 invariant beside local-first — loot's sync assumed a trusted peer that already holds the whole store, so a forge must ask of every fact whether the wire carries it. Five tables have hit this already; the sixth should be anticipated. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> --------- Git-Author: Connor Miller <53197564+Connor-Miller@users.noreply.github.com> f8b890b5diff
• the per-path custody gate stops building a heap key before it can ask its question, because the grant manifest is indexed as a map of oid to a map of grantee rather than one map under an (oid, grantee) pair, so grant_for probes both levels by borrow and the 4,000 Strings a timed visible_paths call allocated and threw away are gone, taking the visibility pair a loot diff makes over a 2000-path tree from 0.7026 ms to 0.6069 ms in both directions (#1550) ebe1b5c0 · dbf3dbe6…diff

Renames are not followed. loot's tree maps a path to an address, so a rename is a delete and an add. This list is the history of the name, not of the bytes.